cloudflare-rails 1.0.0 → 2.2.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: fcb7d261366df6768af3b9884a18e8b782d6cf5f81f11ef14c18b017d394041f
-  data.tar.gz: 5870001e58046915a6bdd8c47f10241e5f54bf161bd5c771da685276cee2185f
+  metadata.gz: 84dc9aec556073a4d870a4784e841e63f8a047ade776f55646617d90ae57a350
+  data.tar.gz: b2d3411fae45afc2e4f9586dc3c9fddd966c2dab028fdef278a2e57e2fb11cca
 SHA512:
-  metadata.gz: 014abb7c27aa87e3f30a1b9c3e0daf09597cee895e6818af203a70de0c1c87648357a4e5eb138c3e9439cd1a5406d17ae099be32652cc432b023e7642e592bb2
-  data.tar.gz: fdcfe22eddcea78cbcbac63fbb50a715715bf7de0ac9e0a3139f288b466f747e5bffb984512af4a288db70063ba78978a6f2f7bc3eab73e761a8e98483af976c
+  metadata.gz: 77da9de7361192e828223e3ee2da7213e8f502971b2bb503f8454e14210233bbabab107dce472d8477b0ef123bb389a8fc31b07fe0bc54d41ccbd5f0312fd474
+  data.tar.gz: 5581a9d55303a8ec303e2e95497d87c20a973ae451f0a38bee98310dffb0d5b408d43b773808c7258acd7ad2c7a657638e874fb67a1d2c1df2bafd54a910eb72

data/.circleci/config.yml

@@ -7,7 +7,7 @@ jobs:
   build:
     docker:
       # specify the version you desire here
-      - image: circleci/ruby:2.7.0
+      - image: circleci/ruby:2.7.3
 
     working_directory: ~/repo
 
@@ -21,6 +21,11 @@ jobs:
           # fallback to using the latest cache if no exact match is found
           - v1-dependencies-
 
+      - run:
+          name: install bundler
+          command: |
+            gem install bundler -v $(grep bundler cloudflare-rails.gemspec |awk {'print $4'}|sed 's/"//g')
+
       - run:
           name: install dependencies
           command: |

data/Appraisals

@@ -1,11 +1,3 @@
-appraise "rails-5.0" do
-  gem "rails", "~> 5.0.0"
-end
-
-appraise "rails-5.1" do
-  gem "rails", "~> 5.1.0"
-end
-
 appraise "rails-5.2" do
   gem "rails", "~> 5.2.0"
 end
@@ -13,3 +5,11 @@ end
 appraise "rails-6.0" do
   gem "rails", "~> 6.0.0"
 end
+
+appraise "rails-6.1" do
+  gem "rails", "~> 6.1.0"
+end
+
+appraise "rails-7.0" do
+  gem "rails", git: "https://github.com/rails/rails", branch: "main"
+end

data/CHANGELOG.md

@@ -4,7 +4,20 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
-## [Unreleased]
+## [2.2.0] - 2021-06-11
+- Fix typo in `actionpack` dependency
+
+## [2.1.0] - 2021-06-11
+### Breaking Changes
+- Drop support for unsupported `rails` versions (`5.0.x` and `5.1.x`)
+
+### Added
+- use Net::HTTP instead of httparty ([pr](https://github.com/modosc/cloudflare-rails/pull/44))
+- Add `rails 7.0.0.alpha` support
+
+## [2.0.0] - 2021-02-17
+### Breaking Changes
+- Removed broad dependency on `rails`, replaced with explicit dependencies for `railties`, `activesupport`, and `actionpack` ( [issue](https://github.com/modosc/cloudflare-rails/issues/34) and [pr](https://github.com/modosc/cloudflare-rails/pull/35))
 
 ## [1.0.0] - 2020-09-29
 ### Added

data/Gemfile

@@ -2,3 +2,7 @@ source 'https://rubygems.org'
 
 # Specify your gem's dependencies in cloudflare-rails.gemspec
 gemspec
+
+group :development do
+  gem "rspec-isolation", git: "https://github.com/modosc/rspec-isolation"
+end

data/README.md

@@ -3,9 +3,11 @@ This gem correctly configures Rails for [CloudFlare](https://www.cloudflare.com)
 
 ## Rails Compatibility
 
-For Rails 5 / 6, use >= `0.6.x`
+This gem requires `railties`, `activesupport`, and `actionpack` >= `5.2`.
 
-For Rails 4.2, use `0.1.x`
+For Rails `5.0` and `5.1` use `2.0.0`.
+
+For Rails `4.2` use `0.1.x`.
 
 ## Installation
 
@@ -25,12 +27,12 @@ And then execute:
 
 ## Problem
 
-Using Cloudflare means it's hard to identify the IP address of incoming requests since all requests are proxied through Cloudflare's infrastructure. Cloudflare provides a [CF-Connecting-IP](https://support.cloudflare.com/hc/en-us/articles/200170986-How-does-Cloudflare-handle-HTTP-Request-headers-) header which can be used to identify the originating IP address of a request. However, this header alone doesn't verify a request is legitimate. If an attacker has found the actual IP address of your server they could spoof this header and masquerade as legitimate traffic. 
+Using Cloudflare means it's hard to identify the IP address of incoming requests since all requests are proxied through Cloudflare's infrastructure. Cloudflare provides a [CF-Connecting-IP](https://support.cloudflare.com/hc/en-us/articles/200170986-How-does-Cloudflare-handle-HTTP-Request-headers-) header which can be used to identify the originating IP address of a request. However, this header alone doesn't verify a request is legitimate. If an attacker has found the actual IP address of your server they could spoof this header and masquerade as legitimate traffic.
 
-`cloudflare-rails` mitigates this attack by checking that the originating ip address of any incoming connecting is from one of Cloudflare's ip address ranges. If so, the incoming `X-Forwarded-For` header is trusted and used as the ip address provided to `rack` and `rails` (via `request.ip` and `request.remote_ip`). If the incoming connection does not originate from a Cloudflare server then the `X-Forwarded-For` header is ignored and the actual remote ip address is used.
+`cloudflare-rails` mitigates this attack by checking that the originating ip address of any incoming connection is from one of Cloudflare's ip address ranges. If so, the incoming `X-Forwarded-For` header is trusted and used as the ip address provided to `rack` and `rails` (via `request.ip` and `request.remote_ip`). If the incoming connection does not originate from a Cloudflare server then the `X-Forwarded-For` header is ignored and the actual remote ip address is used.
 
 ## Usage
-This code will fetch CloudFlare's current [IPv4](https://www.cloudflare.com/ips-v4) and [IPv6](https://www.cloudflare.com/ips-v6) lists, store them in `Rails.cache`, and add them to `config.cloudflare.ips`. The `X-Forwarded-For` header will then be trusted only from those ip addresses. 
+This code will fetch CloudFlare's current [IPv4](https://www.cloudflare.com/ips-v4) and [IPv6](https://www.cloudflare.com/ips-v6) lists, store them in `Rails.cache`, and add them to `config.cloudflare.ips`. The `X-Forwarded-For` header will then be trusted only from those ip addresses.
 
 You can configure the HTTP `timeout` and `expires_in` cache parameters inside of your rails config:
 ```ruby
@@ -40,7 +42,7 @@ config.cloudflare.timeout = 5.seconds # default value
 
 ## Alternatives
 
-[actionpack-cloudflare](https://github.com/customink/actionpack-cloudflare) simpler approach using the `CF-Connecting-IP` header. 
+[actionpack-cloudflare](https://github.com/customink/actionpack-cloudflare) simpler approach using the `CF-Connecting-IP` header.
 
 ## Development
 

data/cloudflare-rails.gemspec

@@ -20,19 +20,20 @@ Gem::Specification.new do |spec|
   spec.executables   = spec.files.grep(%r{^exe/}) { |f| File.basename(f) }
   spec.require_paths = ["lib"]
 
-  spec.add_development_dependency "bundler", "~> 2.1.2"
+  spec.add_development_dependency "bundler", ">= 2.1.2"
   spec.add_development_dependency "rake", "~> 13.0.1"
   spec.add_development_dependency "rspec_junit_formatter", "~> 0.4.1"
-  spec.add_development_dependency "rspec-rails", "~> 4.0.0"
-  spec.add_development_dependency "rspec", "~> 3.9.0"
+  spec.add_development_dependency "rspec-rails", "~> 5.0.1"
+  spec.add_development_dependency "rspec", "~> 3.10.0"
   spec.add_development_dependency "rubocop-airbnb", "~> 3.0.2"
-  spec.add_development_dependency "webmock", "~> 3.9.1"
-  spec.add_development_dependency "rack-attack", "~> 6.3.0"
+  spec.add_development_dependency "webmock", "~> 3.13.0"
+  spec.add_development_dependency "rack-attack", "~> 6.5.0"
   spec.add_development_dependency "pry-byebug"
   spec.add_development_dependency "appraisal"
 
-  spec.add_dependency "httparty"
-  spec.add_dependency "rails", ">= 5.0", "< 6.1.0"
+  spec.add_dependency "railties", ">= 5.2", "< 7.1.0"
+  spec.add_dependency "activesupport", ">= 5.2", "< 7.1.0"
+  spec.add_dependency "actionpack", ">= 5.2", "< 7.1.0"
 
   # we need Module#prepend
   spec.required_ruby_version = '>= 2.0'

data/gemfiles/rails_5.2.gemfile

@@ -4,4 +4,8 @@ source "https://rubygems.org"
 
 gem "rails", "~> 5.2.0"
 
+group :development do
+  gem "rspec-isolation", git: "https://github.com/modosc/rspec-isolation"
+end
+
 gemspec path: "../"

data/gemfiles/rails_6.0.gemfile

@@ -4,4 +4,8 @@ source "https://rubygems.org"
 
 gem "rails", "~> 6.0.0"
 
+group :development do
+  gem "rspec-isolation", git: "https://github.com/modosc/rspec-isolation"
+end
+
 gemspec path: "../"

data/gemfiles/rails_6.1.gemfile

@@ -0,0 +1,11 @@
+# This file was generated by Appraisal
+
+source "https://rubygems.org"
+
+gem "rails", "~> 6.1.0"
+
+group :development do
+  gem "rspec-isolation", git: "https://github.com/modosc/rspec-isolation"
+end
+
+gemspec path: "../"

data/gemfiles/rails_7.0.gemfile

@@ -0,0 +1,11 @@
+# This file was generated by Appraisal
+
+source "https://rubygems.org"
+
+gem "rails", git: "https://github.com/rails/rails", branch: "main"
+
+group :development do
+  gem "rspec-isolation", git: "https://github.com/modosc/rspec-isolation"
+end
+
+gemspec path: "../"

data/lib/cloudflare/rails.rb

@@ -1,5 +1,6 @@
 require "cloudflare/rails/version"
-require "httparty"
+require 'net/http'
+require 'uri'
 
 module Cloudflare
   module Rails

data/lib/cloudflare/rails/railtie.rb

@@ -1,4 +1,4 @@
-require "httparty"
+require "active_support/core_ext/integer/time"
 
 module Cloudflare
   module Rails
@@ -20,13 +20,23 @@ module Cloudflare
       end
 
       class Importer
-        include HTTParty
-        base_uri 'https://www.cloudflare.com'
-        follow_redirects true
-        default_options.update(verify: true)
+        # Exceptions contain the Net::HTTP
+        # response object accessible via the {#response} method.
+        class ResponseError < StandardError
+          # Returns the response of the last request
+          # @return [Net::HTTPResponse] A subclass of Net::HTTPResponse, e.g.
+          # Net::HTTPOK
+          attr_reader :response
 
-        class ResponseError < HTTParty::ResponseError; end
+          # Instantiate an instance of ResponseError with a Net::HTTPResponse object
+          # @param [Net::HTTPResponse]
+          def initialize(response)
+            @response = response
+            super(response)
+          end
+        end
 
+        BASE_URL = 'https://www.cloudflare.com'.freeze
         IPS_V4_URL = '/ips-v4'.freeze
         IPS_V6_URL = '/ips-v6'.freeze
 
@@ -40,11 +50,21 @@ module Cloudflare
           end
 
           def fetch(url)
-            resp = get url, timeout: ::Rails.application.config.cloudflare.timeout
-            if resp.success?
+            uri = URI("#{BASE_URL}#{url}")
+
+            resp = Net::HTTP.start(uri.host,
+                                   uri.port,
+                                   use_ssl: true,
+                                   read_timeout: ::Rails.application.config.cloudflare.timeout) do |http|
+              req = Net::HTTP::Get.new(uri)
+
+              http.request(req)
+            end
+
+            if resp.is_a?(Net::HTTPSuccess)
               resp.body.split("\n").reject(&:blank?).map { |ip| IPAddr.new ip }
             else
-              raise ResponseError, resp.response
+              raise ResponseError, resp
             end
           end
 

data/lib/cloudflare/rails/version.rb

@@ -1,5 +1,5 @@
 module Cloudflare
   module Rails
-    VERSION = "1.0.0".freeze
+    VERSION = "2.2.0".freeze
   end
 end

metadata

@@ -1,27 +1,27 @@
 --- !ruby/object:Gem::Specification
 name: cloudflare-rails
 version: !ruby/object:Gem::Version
-  version: 1.0.0
+  version: 2.2.0
 platform: ruby
 authors:
 - jonathan schatz
 autorequire:
 bindir: exe
 cert_chain: []
-date: 2020-09-30 00:00:00.000000000 Z
+date: 2021-06-11 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: bundler
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ">="
       - !ruby/object:Gem::Version
         version: 2.1.2
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ">="
       - !ruby/object:Gem::Version
         version: 2.1.2
 - !ruby/object:Gem::Dependency
@@ -58,28 +58,28 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 4.0.0
+        version: 5.0.1
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 4.0.0
+        version: 5.0.1
 - !ruby/object:Gem::Dependency
   name: rspec
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 3.9.0
+        version: 3.10.0
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 3.9.0
+        version: 3.10.0
 - !ruby/object:Gem::Dependency
   name: rubocop-airbnb
   requirement: !ruby/object:Gem::Requirement
@@ -100,28 +100,28 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 3.9.1
+        version: 3.13.0
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 3.9.1
+        version: 3.13.0
 - !ruby/object:Gem::Dependency
   name: rack-attack
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 6.3.0
+        version: 6.5.0
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 6.3.0
+        version: 6.5.0
 - !ruby/object:Gem::Dependency
   name: pry-byebug
   requirement: !ruby/object:Gem::Requirement
@@ -151,39 +151,65 @@ dependencies:
       - !ruby/object:Gem::Version
         version: '0'
 - !ruby/object:Gem::Dependency
-  name: httparty
+  name: railties
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: '0'
+        version: '5.2'
+    - - "<"
+      - !ruby/object:Gem::Version
+        version: 7.1.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: '0'
+        version: '5.2'
+    - - "<"
+      - !ruby/object:Gem::Version
+        version: 7.1.0
+- !ruby/object:Gem::Dependency
+  name: activesupport
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '5.2'
+    - - "<"
+      - !ruby/object:Gem::Version
+        version: 7.1.0
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '5.2'
+    - - "<"
+      - !ruby/object:Gem::Version
+        version: 7.1.0
 - !ruby/object:Gem::Dependency
-  name: rails
+  name: actionpack
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: '5.0'
+        version: '5.2'
     - - "<"
       - !ruby/object:Gem::Version
-        version: 6.1.0
+        version: 7.1.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: '5.0'
+        version: '5.2'
     - - "<"
       - !ruby/object:Gem::Version
-        version: 6.1.0
+        version: 7.1.0
 description: ''
 email:
 - modosc@users.noreply.github.com
@@ -209,10 +235,10 @@ files:
 - bin/setup
 - cloudflare-rails.gemspec
 - gemfiles/.bundle/config
-- gemfiles/rails_5.0.gemfile
-- gemfiles/rails_5.1.gemfile
 - gemfiles/rails_5.2.gemfile
 - gemfiles/rails_6.0.gemfile
+- gemfiles/rails_6.1.gemfile
+- gemfiles/rails_7.0.gemfile
 - lib/cloudflare/rails.rb
 - lib/cloudflare/rails/railtie.rb
 - lib/cloudflare/rails/version.rb
@@ -235,7 +261,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.1.2
+rubygems_version: 3.2.18
 signing_key:
 specification_version: 4
 summary: This gem configures Rails for CloudFlare so that request.ip and request.remote_ip

data/gemfiles/rails_5.0.gemfile

@@ -1,7 +0,0 @@
-# This file was generated by Appraisal
-
-source "https://rubygems.org"
-
-gem "rails", "~> 5.0.0"
-
-gemspec path: "../"

data/gemfiles/rails_5.1.gemfile

@@ -1,7 +0,0 @@
-# This file was generated by Appraisal
-
-source "https://rubygems.org"
-
-gem "rails", "~> 5.1.0"
-
-gemspec path: "../"